How to get user name instead of SID during WMI logcollection

Question

How to get user name instead of SID during WMI logcollection

shiv raj kr 1

I'm looking for a possible solution to convert a Windows user SID to a username.

I am running WQL queries against some local namespace and would like to know if there are any possibilities to get a username instead SID like an event viewer. I am using WBEMTest for testing.

Screenshot for reference.

Any help much appreciated? Thank you.

2 answers

Your answer

Answer 1

Castorix31 90,686

You can use Win32_UserAccount with the right SID

shiv raj kr 1 Reputation point

2022-02-07T15:15:48.177+00:00

Thank you for the reply castorix31.

But my requirement is to show the username under the Message field of win32_ntlogevent class like above screenshot. and i have another question about how the event viewer shows the name correctly but the win32_ntlogevent doesn't.

Once again. thanks for the reply.

Answer 2

Clément BETACORNE 2,496

Hello,

This command will query the table where you can find SIDs :

Select * From win32_accountSID

https://learn.microsoft.com/en-us/previous-versions/windows/desktop/secrcw32prov/win32-accountsid

Regards,

shiv raj kr 1 Reputation point

2022-02-07T15:23:19.767+00:00

Thank you for the reply clementbetacorne

But my requirement is to show the username under the Message field of win32_ntlogevent class like above screenshot. and i have another question about how the event viewer shows the name correctly but the win32_ntlogevent doesn't.

Once again. thanks for the reply.
Clément BETACORNE 2,496 Reputation points

2022-02-07T16:23:59.13+00:00

The message field is based on the "InsertionStrings" so you will not be able to modify it directly, the event viewer is able to show you the name correctly because some parsing is done.
Do you have some requirement to do it with WQL ? Is it possible to use PowerShell ?

Regards,

Share via

How to get user name instead of SID during WMI logcollection

2 answers

Your answer